HIPAA and your dietitian website: what a contact form should and shouldn't collect

Keep health information off your public website. Your contact form should collect contact details and a general message, with a clear note not to send health details. Intake forms, notes and anything clinical belong in your secure practice platform.

This is general information, not legal advice. Whether HIPAA applies to you depends on your practice, so ask a compliance adviser or lawyer.

Why "HIPAA compliant website" is a claim to question

HIPAA isn't a badge a website earns. It concerns how covered organisations and their partners handle protected health information, including agreements called business associate agreements. A web designer can't make your practice compliant with a line on a sales page.

You can reduce your risk a great deal by keeping that information out of your website altogether.

What a contact form should collect

• Name
• Email or phone
• A general question or how they heard about you
• A note: "Please don't send health details through this form"

What it shouldn't collect

• Symptoms, diagnoses, medications or weight
• Insurance member IDs
• Date of birth
• Details about a child or another person's health
• Referral notes from doctors

Someone may still type these into a message box, so keep the warning visible, delete what you don't need, and move the conversation to your secure platform.

Where intake forms belong

In your practice platform, such as Practice Better, Healthie or SimplePractice, under whatever agreement that company offers. Your website simply links to it.

Watch out for tracking

Tracking pixels can send information about visitors to advertising companies. On a health website, that deserves real thought. We avoid advertising pixels by default, and don't use analytics in client portals. Ask your adviser what suits your practice.

Email and booking

• Regular email usually isn't a secure place for health details, so consider asking clients to use your portal.
• Booking tools vary. Check what your tool offers before you ask health questions in it.
• WhatsApp and other chat tools are handy for general questions, not clinical ones.

A five-minute check for your site

1. Open your contact form. Does it ask for anything clinical? Remove it.
2. Add the warning not to send health details.
3. Check whether a form sends to an ordinary inbox, and what ends up there.
4. Look for advertising pixels on your site, or ask your developer.
5. Make sure intake links go to your secure platform.

We set up Itersi sites this way from day one. See more on privacy and legal basics, or ask us for a free website check.